urlscan.io logo urlscan.io
SecurityTrails logo

portal.empiremedicaltraining.org Open in urlscan Pro
205.186.160.121  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://mymembersportal.com/
Effective URL: https://portal.empiremedicaltraining.org/
Submission Tags: phishingrod
Submission: On May 20 via api from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 2 countries across 7 domains to perform 21 HTTP transactions. The main IP is 205.186.160.121, located in Ashburn, United States and belongs to GO-DADDY-COM-LLC, US. The main domain is portal.empiremedicaltraining.org.
TLS certificate: Issued by R3 on April 30th 2023. Valid for: 3 months.
This is the only time portal.empiremedicaltraining.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
14 205.186.160.121 398110 (GO-DADDY-...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 54.230.111.8 16509 (AMAZON-02)
1 143.204.55.68 16509 (AMAZON-02)
1 2001:4860:480... 15169 (GOOGLE)
1 54.230.111.64 16509 (AMAZON-02)
21 7
14    205.186.160.121 (Ashburn, United States)

ASN398110 (GO-DADDY-COM-LLC, US)
PTR: new-empiremedicaltraining.com
mymembersportal.com
portal.empiremedicaltraining.org
1    2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    54.230.111.8 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-230-111-8.osl50.r.cloudfront.net
static.hotjar.com
1    143.204.55.68 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-55-68.osl50.r.cloudfront.net
script.hotjar.com
1    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
1    54.230.111.64 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-230-111-64.osl50.r.cloudfront.net
vc.hotjar.io
Apex Domain
Subdomains		 Transfer
13 empiremedicaltraining.org
portal.empiremedicaltraining.org
567 KB
2 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 633
script.hotjar.com — Cisco Umbrella Rank: 793
73 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 40
135 KB
1 hotjar.io
vc.hotjar.io — Cisco Umbrella Rank: 2204
259 B
1 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 2230
265 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 35
799 B
1 mymembersportal.com
mymembersportal.com
297 B
21 7
Domain Requested by
13 portal.empiremedicaltraining.org portal.empiremedicaltraining.org
2 www.googletagmanager.com portal.empiremedicaltraining.org
www.googletagmanager.com
1 vc.hotjar.io script.hotjar.com
1 region1.google-analytics.com www.googletagmanager.com
1 script.hotjar.com static.hotjar.com
1 static.hotjar.com portal.empiremedicaltraining.org
1 fonts.googleapis.com portal.empiremedicaltraining.org
1 mymembersportal.com
21 8

This site contains no links.

Subject Issuer Validity Valid
mymembersportal.com
R3		 2023-05-20 -
2023-08-18		 3 months crt.sh
portal.empiremedicaltraining.org
R3		 2023-04-30 -
2023-07-29		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-04-24 -
2023-07-17		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-04-24 -
2023-07-17		 3 months crt.sh
*.hotjar.com
Amazon ECDSA 256 M01		 2023-03-09 -
2024-04-06		 a year crt.sh
*.hotjar.io
Amazon ECDSA 256 M01		 2023-03-09 -
2024-04-06		 a year crt.sh

This page contains 1 frames:

Primary Page: https://portal.empiremedicaltraining.org/
Frame ID: 55263B2421F659A295FF90C884922AEC
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Member's Portal

Page URL History Show full URLs

  1. https://mymembersportal.com/ Page URL
  2. https://portal.empiremedicaltraining.org/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

21
Requests

100 %
HTTPS

43 %
IPv6

7
Domains

8
Subdomains

7
IPs

2
Countries

776 kB
Transfer

1527 kB
Size

8
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://mymembersportal.com/ Page URL
  2. https://portal.empiremedicaltraining.org/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
mymembersportal.com/ 		251 B
297 B 		Document
General
Check archive.org
Download Go to
Full URL
https://mymembersportal.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
205.186.160.121 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS
new-empiremedicaltraining.com
Software
nginx / PleskLin
Resource Hash
d7b7ea9201762bbd43b54c4bfc56db3666d47aaa2fafdb7d87ef48169465fdf9

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-type
text/html
date
Sat, 20 May 2023 18:51:38 GMT
etag
W/"fb-5cfbe92205492"
last-modified
Mon, 01 Nov 2021 18:44:45 GMT
server
nginx
x-accel-version
0.01
x-powered-by
PleskLin
Primary Request /
portal.empiremedicaltraining.org/ 		18 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://portal.empiremedicaltraining.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
205.186.160.121 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS
new-empiremedicaltraining.com
Software
nginx / PHP/7.3.33 PleskLin
Resource Hash
c8a593f98048b4abf7448ad6f75c562b324cd0a7cddc2d067350f946dc54f26c
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://mymembersportal.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
4009
content-type
text/html; charset=UTF-8
date
Sat, 20 May 2023 18:51:40 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
strict-transport-security
max-age=15768000; includeSubDomains
vary
Accept-Encoding
x-powered-by
PHP/7.3.33 PleskLin
popper.min.js
portal.empiremedicaltraining.org/assets/js/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://portal.empiremedicaltraining.org/assets/js/popper.min.js
Requested by
Host: portal.empiremedicaltraining.org
URL: https://portal.empiremedicaltraining.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
205.186.160.121 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS
new-empiremedicaltraining.com
Software
nginx / PleskLin
Resource Hash
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 18:51:40 GMT
strict-transport-security
max-age=15768000; includeSubDomains
content-encoding
br
last-modified
Wed, 08 Dec 2021 22:11:01 GMT
server
nginx
etag
W/"61b12d75-4af4"
x-powered-by
PleskLin
content-type
application/javascript
bootstrap.min.css
portal.empiremedicaltraining.org/assets/css/ 		158 KB
21 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://portal.empiremedicaltraining.org/assets/css/bootstrap.min.css
Requested by
Host: portal.empiremedicaltraining.org
URL: https://portal.empiremedicaltraining.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
205.186.160.121 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS
new-empiremedicaltraining.com
Software
nginx / PleskLin
Resource Hash
4ffcc598ee6cff4692c1cea272cd8a2f195f6dec32473e94370d6cdcfa5fe601
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 18:51:40 GMT
strict-transport-security
max-age=15768000; includeSubDomains
content-encoding
br
last-modified
Fri, 17 Sep 2021 14:29:58 GMT
server
nginx
etag
W/"6144a666-27681"
x-powered-by
PleskLin
content-type
text/css
styles-index.css
portal.empiremedicaltraining.org/assets/css/ 		37 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://portal.empiremedicaltraining.org/assets/css/styles-index.css
Requested by
Host: portal.empiremedicaltraining.org
URL: https://portal.empiremedicaltraining.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
205.186.160.121 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS
new-empiremedicaltraining.com
Software
nginx / PleskLin
Resource Hash
e1751c3ccf9f00a1e2947f7132a5fd331f0b4f2e25f87b93c3e502db50dbc264
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 18:51:40 GMT
strict-transport-security
max-age=15768000; includeSubDomains
content-encoding
br
last-modified
Fri, 03 Mar 2023 21:37:17 GMT
server
nginx
etag
W/"6402688d-93a2"
x-powered-by
PleskLin
content-type
text/css
swiper-bundle.min.css
portal.empiremedicaltraining.org/assets/css/ 		13 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://portal.empiremedicaltraining.org/assets/css/swiper-bundle.min.css
Requested by
Host: portal.empiremedicaltraining.org
URL: https://portal.empiremedicaltraining.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
205.186.160.121 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS
new-empiremedicaltraining.com
Software
nginx / PleskLin
Resource Hash
f9a5ed5579185f72f6117a442491cce66c1112389f31eeb954a6b0921386d878
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 18:51:40 GMT
strict-transport-security
max-age=15768000; includeSubDomains
content-encoding
br
last-modified
Fri, 17 Sep 2021 14:30:12 GMT
server
nginx
etag
W/"6144a674-3580"
x-powered-by
PleskLin
content-type
text/css
swiper.css
portal.empiremedicaltraining.org/assets/css/ 		1 KB
548 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://portal.empiremedicaltraining.org/assets/css/swiper.css
Requested by
Host: portal.empiremedicaltraining.org
URL: https://portal.empiremedicaltraining.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
205.186.160.121 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS
new-empiremedicaltraining.com
Software
nginx / PleskLin
Resource Hash
1c94ee36d9d9cbc6cd98d05148faafe623b5b11ada981d2f5252f75eefa812bc
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 18:51:40 GMT
strict-transport-security
max-age=15768000; includeSubDomains
content-encoding
br
last-modified
Fri, 17 Sep 2021 14:30:13 GMT
server
nginx
etag
W/"6144a675-501"
x-powered-by
PleskLin
content-type
text/css
jquery.min.js
portal.empiremedicaltraining.org/assets/js/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://portal.empiremedicaltraining.org/assets/js/jquery.min.js
Requested by
Host: portal.empiremedicaltraining.org
URL: https://portal.empiremedicaltraining.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
205.186.160.121 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS
new-empiremedicaltraining.com
Software
nginx / PleskLin
Resource Hash
22098889a3d150df9706ff90386764f183274d40903f5eee2ec97fef24e2c5b4
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 18:51:40 GMT
strict-transport-security
max-age=15768000; includeSubDomains
content-encoding
br
last-modified
Fri, 17 Sep 2021 14:30:17 GMT
server
nginx
etag
W/"6144a679-15d43"
x-powered-by
PleskLin
content-type
application/javascript
css2
fonts.googleapis.com/ 		616 B
799 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Material+Icons+Outlined
Requested by
Host: portal.empiremedicaltraining.org
URL: https://portal.empiremedicaltraining.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
3f93939a32d53667337d1f980bb4fcac832e561c97882de60da2b9e49426d95a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sat, 20 May 2023 18:51:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sat, 20 May 2023 18:51:40 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 20 May 2023 18:51:40 GMT
styles-login-2.css
portal.empiremedicaltraining.org/assets/css/ 		2 KB
862 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://portal.empiremedicaltraining.org/assets/css/styles-login-2.css
Requested by
Host: portal.empiremedicaltraining.org
URL: https://portal.empiremedicaltraining.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
205.186.160.121 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS
new-empiremedicaltraining.com
Software
nginx / PleskLin
Resource Hash
7e328d7bc9fb7eef9bb736325f158b9ae3cd6e51801226030af81eb2ca6c04bf
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 18:51:40 GMT
strict-transport-security
max-age=15768000; includeSubDomains
content-encoding
br
last-modified
Tue, 11 Jan 2022 16:23:37 GMT
server
nginx
etag
W/"61ddaf09-90e"
x-powered-by
PleskLin
content-type
text/css
login-emt-logo.svg
portal.empiremedicaltraining.org/assets/img/ 		129 KB
129 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://portal.empiremedicaltraining.org/assets/img/login-emt-logo.svg
Requested by
Host: portal.empiremedicaltraining.org
URL: https://portal.empiremedicaltraining.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
205.186.160.121 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS
new-empiremedicaltraining.com
Software
nginx / PleskLin
Resource Hash
ece70cbfca221a1c41c45b9cbccd1788c3863e615b60bc03cc9dc38d8ca92922
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 18:51:40 GMT
strict-transport-security
max-age=15768000; includeSubDomains
last-modified
Fri, 17 Sep 2021 14:30:38 GMT
server
nginx
etag
"6144a68e-2037a"
x-powered-by
PleskLin
content-type
image/svg+xml
accept-ranges
bytes
content-length
131962
bootstrap.min.js
portal.empiremedicaltraining.org/assets/js/ 		62 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://portal.empiremedicaltraining.org/assets/js/bootstrap.min.js
Requested by
Host: portal.empiremedicaltraining.org
URL: https://portal.empiremedicaltraining.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
205.186.160.121 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS
new-empiremedicaltraining.com
Software
nginx / PleskLin
Resource Hash
edd03b96ae4ff7886406c59d7dfeeaa1b624a7da297bf2f92d0cb6b7f9633cba
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 18:51:40 GMT
strict-transport-security
max-age=15768000; includeSubDomains
content-encoding
br
last-modified
Fri, 17 Sep 2021 14:30:17 GMT
server
nginx
etag
W/"6144a679-f7eb"
x-powered-by
PleskLin
content-type
application/javascript
gtm.js
www.googletagmanager.com/ 		156 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-N6S8BMN
Requested by
Host: portal.empiremedicaltraining.org
URL: https://portal.empiremedicaltraining.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b6bfed340d8ed4eda7d73c4d37f98be39f311892800f3def5cde23b565570e5f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 18:51:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57833
x-xss-protection
0
last-modified
Sat, 20 May 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 20 May 2023 18:51:40 GMT
hotjar-2683640.js
static.hotjar.com/c/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hotjar.com/c/hotjar-2683640.js?sv=6
Requested by
Host: portal.empiremedicaltraining.org
URL: https://portal.empiremedicaltraining.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.111.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-111-8.osl50.r.cloudfront.net
Software
/
Resource Hash
63afe0b9cdae78cb77da5b37d1f426fb406802bb135d8bdabeeb9b99e6eecb03
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 18:51:40 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop
OSL50-P1
etag
W/3f718934248073c25f3d2e0d590d33d6
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=60
x-cache-hit
1
cross-origin-resource-policy
cross-origin
x-amz-cf-id
0vkH-JnVqOF2-w_MGxJPliJ-6wuJ13MxLLSQRdfN1PvJwIuerilpLQ==
login-background-2.jpg
portal.empiremedicaltraining.org/assets/img/ 		311 KB
312 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://portal.empiremedicaltraining.org/assets/img/login-background-2.jpg
Requested by
Host: portal.empiremedicaltraining.org
URL: https://portal.empiremedicaltraining.org/assets/css/styles-login-2.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
205.186.160.121 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS
new-empiremedicaltraining.com
Software
nginx / PleskLin
Resource Hash
9abf92bea4da813895388ee44ef7404f118f4e0cea582f5d7d95c9b181b2f1e3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/assets/css/styles-login-2.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 18:51:40 GMT
strict-transport-security
max-age=15768000; includeSubDomains
last-modified
Thu, 04 Nov 2021 18:28:57 GMT
server
nginx
etag
"61842669-4dc7b"
x-powered-by
PleskLin
content-type
image/jpeg
accept-ranges
bytes
content-length
318587
montserrat-v18-latin-regular.woff2
portal.empiremedicaltraining.org/assets/fonts/ 		19 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://portal.empiremedicaltraining.org/assets/fonts/montserrat-v18-latin-regular.woff2
Requested by
Host: portal.empiremedicaltraining.org
URL: https://portal.empiremedicaltraining.org/assets/css/styles-index.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
205.186.160.121 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS
new-empiremedicaltraining.com
Software
nginx / PleskLin
Resource Hash
2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://portal.empiremedicaltraining.org/assets/css/styles-index.css
Origin
https://portal.empiremedicaltraining.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 18:51:40 GMT
strict-transport-security
max-age=15768000; includeSubDomains
last-modified
Fri, 17 Sep 2021 14:30:40 GMT
server
nginx
etag
"6144a690-4d84"
x-powered-by
PleskLin
content-type
font/woff2
accept-ranges
bytes
content-length
19844
montserrat-v18-latin-600.woff2
portal.empiremedicaltraining.org/assets/fonts/ 		19 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://portal.empiremedicaltraining.org/assets/fonts/montserrat-v18-latin-600.woff2
Requested by
Host: portal.empiremedicaltraining.org
URL: https://portal.empiremedicaltraining.org/assets/css/styles-index.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
205.186.160.121 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS
new-empiremedicaltraining.com
Software
nginx / PleskLin
Resource Hash
61519deaa156f24ad28ae848179016c7cc741270cb7b30043c24bd30203bdaf3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://portal.empiremedicaltraining.org/assets/css/styles-index.css
Origin
https://portal.empiremedicaltraining.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 18:51:40 GMT
strict-transport-security
max-age=15768000; includeSubDomains
last-modified
Fri, 17 Sep 2021 14:30:41 GMT
server
nginx
etag
"6144a691-4d70"
x-powered-by
PleskLin
content-type
font/woff2
accept-ranges
bytes
content-length
19824
modules.bd615e91f206bba6c106.js
script.hotjar.com/ 		265 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.hotjar.com/modules.bd615e91f206bba6c106.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2683640.js?sv=6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.55.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-55-68.osl50.r.cloudfront.net
Software
/
Resource Hash
b7d6c0f9a48e8bf195039d4d918a412030b9eca30e15813ba606ea8aecc5b4f3
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Fri, 19 May 2023 12:11:07 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 9dd61138197a68f8d69f12574aab6930.cloudfront.net (CloudFront)
x-amz-cf-pop
OSL50-C1
age
110433
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
69451
last-modified
Fri, 19 May 2023 12:10:27 GMT
etag
"9426a0fb3ec77e5ad24ce096383ab689"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
eTL1RmjO5XgZICYi7ei1BXnc4NCHFgB-zxk34W-3_UzZUQfI6pFWhw==
js
www.googletagmanager.com/gtag/ 		221 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-4DJLJ31R6P&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N6S8BMN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
70e362f2ccd05eeb844313a47e6c414ba5968cd0715229e2627bffa95a367fac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 18:51:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
79646
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Sat, 20 May 2023 18:51:40 GMT
collect
region1.google-analytics.com/g/ 		0
265 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-4DJLJ31R6P&gtm=45je35h0&_p=2092979102&cid=978376950.1684608701&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1684608700&sct=1&seg=0&dl=https%3A%2F%2Fportal.empiremedicaltraining.org%2F&dr=https%3A%2F%2Fmymembersportal.com%2F&dt=Member%27s%20Portal&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4DJLJ31R6P&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 20 May 2023 18:51:41 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://portal.empiremedicaltraining.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
2683640
vc.hotjar.io/sessions/ 		0
259 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vc.hotjar.io/sessions/2683640?s=0.25&r=0.11488561961907395
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.bd615e91f206bba6c106.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.111.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-111-64.osl50.r.cloudfront.net
Software
Python/3.8 aiohttp/3.8.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://portal.empiremedicaltraining.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 18:51:41 GMT
via
1.1 d9fb4c3794a085bb4ee2c5798c2cb1b8.cloudfront.net (CloudFront)
server
Python/3.8 aiohttp/3.8.4
x-amz-cf-pop
OSL50-P1
x-cache
Miss from cloudfront
access-control-allow-origin
*
cache-control
no-store
x-amz-cf-id
NQuIpVTOyAgEqcjdbUwVYCDmGanNA8xnIKBUOjgynDruA4I7DAJk3g==

Verdicts & Comments Add Verdict or Comment

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| dataLayer function| Popper function| $ function| jQuery function| hj object| _hjSettings object| bootstrap object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal

8 Cookies

Domain/Path Name / Value
portal.empiremedicaltraining.org/ Name: PHPSESSID
Value: 3nvk74gdho2bpfjeti40rdlolc
.empiremedicaltraining.org/ Name: _ga
Value: GA1.1.978376950.1684608701
.empiremedicaltraining.org/ Name: _ga_4DJLJ31R6P
Value: GS1.1.1684608700.1.0.1684608700.0.0.0
.empiremedicaltraining.org/ Name: _hjSessionUser_2683640
Value: eyJpZCI6IjE4ZTNkMjVhLTdiMzEtNTI0My1iOGI1LTM3NzgwZTIyMzllZiIsImNyZWF0ZWQiOjE2ODQ2MDg3MDEwMTQsImV4aXN0aW5nIjpmYWxzZX0=
.empiremedicaltraining.org/ Name: _hjFirstSeen
Value: 1
.empiremedicaltraining.org/ Name: _hjIncludedInSessionSample_2683640
Value: 0
.empiremedicaltraining.org/ Name: _hjSession_2683640
Value: eyJpZCI6ImE3MGNlYjIxLTY4N2QtNDU0My05NDUwLWI0OWY4NjQxYTJmOSIsImNyZWF0ZWQiOjE2ODQ2MDg3MDEwMjEsImluU2FtcGxlIjpmYWxzZX0=
.empiremedicaltraining.org/ Name: _hjAbsoluteSessionInProgress
Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
mymembersportal.com
portal.empiremedicaltraining.org
region1.google-analytics.com
script.hotjar.com
static.hotjar.com
vc.hotjar.io
www.googletagmanager.com
143.204.55.68
2001:4860:4802:32::36
205.186.160.121
2a00:1450:4001:82a::200a
2a00:1450:4001:830::2008
54.230.111.64
54.230.111.8
1c94ee36d9d9cbc6cd98d05148faafe623b5b11ada981d2f5252f75eefa812bc
22098889a3d150df9706ff90386764f183274d40903f5eee2ec97fef24e2c5b4
2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3
3f93939a32d53667337d1f980bb4fcac832e561c97882de60da2b9e49426d95a
4ffcc598ee6cff4692c1cea272cd8a2f195f6dec32473e94370d6cdcfa5fe601
61519deaa156f24ad28ae848179016c7cc741270cb7b30043c24bd30203bdaf3
63afe0b9cdae78cb77da5b37d1f426fb406802bb135d8bdabeeb9b99e6eecb03
70e362f2ccd05eeb844313a47e6c414ba5968cd0715229e2627bffa95a367fac
7e328d7bc9fb7eef9bb736325f158b9ae3cd6e51801226030af81eb2ca6c04bf
9abf92bea4da813895388ee44ef7404f118f4e0cea582f5d7d95c9b181b2f1e3
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
b6bfed340d8ed4eda7d73c4d37f98be39f311892800f3def5cde23b565570e5f
b7d6c0f9a48e8bf195039d4d918a412030b9eca30e15813ba606ea8aecc5b4f3
c8a593f98048b4abf7448ad6f75c562b324cd0a7cddc2d067350f946dc54f26c
d7b7ea9201762bbd43b54c4bfc56db3666d47aaa2fafdb7d87ef48169465fdf9
e1751c3ccf9f00a1e2947f7132a5fd331f0b4f2e25f87b93c3e502db50dbc264
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ece70cbfca221a1c41c45b9cbccd1788c3863e615b60bc03cc9dc38d8ca92922
edd03b96ae4ff7886406c59d7dfeeaa1b624a7da297bf2f92d0cb6b7f9633cba
f9a5ed5579185f72f6117a442491cce66c1112389f31eeb954a6b0921386d878